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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
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Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 
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1 )Ex] Responsive to communication(s) filed on 23 December 2003 . 
2a)M This action is FINAL. 2b)D This action is non-final. 

3)D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 
closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 



is/are withdrawn from consideration. 
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Response To Amendment 



1. This action is responsive to communication received on Dec. 29, 2003. Claims 1- 
54 are pending. 



The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351 (a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

2. Claim 1 1 is rejected under 35 U.S.C. 102(e) as being anticipated by Riddle et al., 
U.S. Patent No. 6,457,051 (referred to hereafter as Riddle). 

Riddle teaches a method for classifying data packets comprising the steps of: 

providing one or more regular expressions, each having an associated 
class identifier (see Table 3 and fig. 4A); 

receiving plural data packets, each having a length not necessarily equal 
to one another (see claim 1); and 

for each data packet, determining a matching one of said regular 
expressions that matches said data packet, wherein said each data packet is classified 
according to the class identifier associated with said matching regular expression (see 
Table 3 and claim 1). 



Claim Rejections - 35 USC § 102 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claims 1, 2, 4 and 12 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Riddle in view of Tang, U.S. Patent No. 5,378,126. 

As to claim 1, Riddle teaches a method for classifying received network data 
comprising scanning incoming data wherein said network data is treated as a stream of 
input bytes (see col. 2 lines 21-27), said network data being organized into data packets 
(see claim 1), said scanning resulting in the identification of a data packet belonging to 
one of a plurality of classes (see claim 1 ). 

Riddle doesn't teach the limitation "scanning data network using lexical token 
scanning". However Tang teaches scanning data using lexical token scanning (see 
abstract, statements in a program are lexically scanned and parsed into a parse tree). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of lexically scanning incoming data packets and 
parsing the lexical tokens as in Tang. One would be motivated to include lexical 
scanning of packets and parsing lexical tokens in Riddle because doing so would allow 
the processor to read the specific lexical token relating to the control protocol layer that 
the instruction belongs to rather than reading the whole instruction or packet and thus 
creating faster communications medium and faster data routing. 
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As to claim 2, Riddle teaches scanning includes identifying an arithmetic 
operation and performing said arithmetic operation (see col. 14 lines 5-8, the system 
optionally keeps track of the number of bytes being scanned). 

As to claim 4, Riddle teaches providing a set of regular expressions, each regular 
expression having an associated class identifier (see Table. 3 and claim 1). 

As to claim 12, Tang teaches scanning said incoming network data using lexical 
token scanning of data stream (see abstract, statements in a program are lexically 
scanned and parsed into a parse tree). 

4. Claims 3 and 18-22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Riddle in view of Tang, further in view of Moreno, U.S. Patent No. 5,951 ,674. 

As to claims 3 and 18, Riddle and Tang teach a method for classifying received 
network data comprising scanning incoming data using lexical token scanning wherein 
said network data is treated as a stream of input bytes, said network data being 
organized into data packets, said scanning resulting in the identification of a data packet 
belonging to one of a plurality of classes (see the rejection of claim 1 ). 

Riddle and Tang do not teach the limitation "scanning includes identifying a skip 
operation and in response thereto skipping over one or more subsequent input bytes". 
However Moreno teaches identifying a skip operation and in response thereto skipping 
over one or more subsequent input bytes (see claims 7 and 8). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of identifying a skip operation and in response 
thereto skipping over one or more subsequent input bytes as in Moreno. One would be 
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motivated to modify Riddle in view of identifying a skip operation and in response 
thereto skipping over one or more subsequent input bytes because doing so would 
allow the processor to detect an error in the stream of incoming data and skip to the 
next data stream by detecting address of the beginning of the next incoming data 
packet. 

As to claim 19, Moreno teaches said number is specified by the value of a 
current input byte (see col. 13). 

As to claim 20, Moreno teaches said number is specified in a register (see col. 

13). 

As to claim 21 , Moreno teaches detecting an operator indicating a value to be 
saved in a register (see col. 13). 

As to claim 22, Moreno teaches detecting an operator indicating a logical 
operation to be performed on the contents of said register (see col. 13). 
5. Claims 5-7 and 9 are rejected under 35 U.S.C 1 03(a) as being unpatentable over 
Riddle in view of Tang in further view of Del Monte, U.S. Patent No. 5,704,060. 

As to claim 5, Riddle and Tang teach a method for classifying received network 
data comprising scanning incoming data using lexical token scanning wherein said 
network data is treated as a stream of input bytes, said network data being organized 
into data packets, said scanning resulting in the identification of a data packet belonging 
to one of a plurality of classes (see the rejection of claim 1 ). 

Riddle and Tang do not teach the limitation "providing a DFA and recognizing 
data packets using said DFA including transitioning from one state to another". 
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However, Del Monte teaches providing a deterministic finite automaton (DFA) 
(see col. 14 lines 21-31). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of including a DFA as in Del Monte including a 
representation of said lexical tokens as in Tang. One would be motivated to include a 
DFA including recognizing the lexical tokens using the DFA in Riddle because doing so 
would allow the DFA to determine the classification of the data packet and map an 
ordered sequence of input events into a corresponding sequence according to the 
control section of the data where the next state is uniquely determined by a single input 
event. 

As to claim 6, Riddle teaches data packets are variable length data packets (see 
claim 1 ). 

As to claim 7, Del Monte teaches said DFA is defined by a set of regular 
expressions (see col. 14 lines 21-31). 

As to claim 9, Riddle teaches said states include one or more associated 
computer instructions wherein said computer instructions are executed in connection 
with transitioning to a state (see fig. 3 and its corresponding illustration). 
6. Claims 8,16 and 17 are rejected under 35 U.S.C 103(a) as being unpatentable 
over Riddle in view of Tang in further view of Del Monte in view of Eager et al., U.S. 
Patent No. 5,960,200 (referred to hereafter as Eager). 

As to claims 8 and 16, Riddle, Tang, and Del Monte teach a method for 
classifying received network data comprising scanning incoming data using lexical 
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token scanning wherein said network data is treated as a stream of input bytes, said 
network data being organized into data packets, said scanning resulting in the 
identification of a data packet belonging to one of a plurality of classes providing a DFA 
(see the rejection of claim 5). 

The combined teachings of Riddle, Tang, and Del Monte do not teach the 
limitation "producing a NFA and converting said NFA to produce said DFA)". However 
Eager teaches producing a NFA and converting said NFA to produce said DFA (see col. 
15 lines 51-67). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of producing a NFA and converting NFA to 
produce FDA because doing so would provide faster processing since processing of 
DFA takes less time than processing NFA. 

As to claim 17, Del Monte teaches reducing said DFA to a compressed form (see 
col. 3 lines 56-67). 

7. Claim 10 is rejected under 35 U.S.C. 103(a) as being unpatentable over Riddle in 
view of Tang, in view of Del Monte further in view of Moreno. 

Riddle and Tang teach a method for classifying received network data 
comprising scanning incoming data using lexical token scanning wherein said network 
data is treated as a stream of input bytes, said network data being organized into data 
packets, said scanning resulting in the identification of a data packet belonging to one of 
a plurality of classes (see the rejection of claim 1 ). 
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Riddle and Tang do not teach the limitation "some of said states further include a 
skip instruction". However Moreno teaches a skip instruction (see claims 7 and 8). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of identifying a skip operation and in response 
thereto skipping over one or more subsequent input bytes as in Moreno. One would be 
motivated to modify Riddle in view of identifying a skip operation and in response 
thereto skipping over one or more subsequent input bytes because doing so would 
allow the processor to detect an error in the stream of incoming data and skip to the 
next data stream by detecting address of the beginning of the next incoming data 
packet. 

8. Claims 13-15 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Riddle in view of Del Monte 

As to claim 13, Riddle teaches a method for classifying data packets comprising 
the steps of providing one or more regular expressions, each having an associated 
class identifier, receiving plural data packets, each having a length not necessarily 
equal to one another, and for each data packet, determining a matching one of said 
regular expressions that matches said data packet, wherein said each data packet is 
classified according to the class identifier associated with said matching regular 
expression (see the rejection of claim 1 1 ). 

Riddle doesn't teach the method of claim 1 wherein the method further including 
providing a deterministic finite automaton (DFA) representing said grammar graph. 
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However, Del Monte teaches providing a deterministic finite automaton (DFA) 
representing grammar graph (see col. 14lines 21-31). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of including a DFA representing said grammar 
graph as in Del Monte. One would be motivated to include a DFA in Riddle because 
doing so would allow the network to map an ordered sequence of input events into a 
corresponding sequence according to the control section of the data where the next 
state is uniquely determined by a single input event. 

As to claim 14, Del Monte teaches DFA is in compressed form (see col. 2 lines 
48-56). 

As to claim 15, Del Monte teaches compiling said regular expressions to produce 
said DFA (see col. 2 lines 48-56). 

9. Claims 30 and 37-41 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Riddle in view of Tang in view of Del Monte, further in view of Boucher. 

As to claim 30, Boucher teaches compiling second classification, configuring a 
programmable hardware packet classifier to classify said received packets, applying 
said data stream to said hardware packet classifier wherein data packets are classified 
according to said second classification rules (see claim 7, if the classification properties 
doesn't exist, a new classification class is created wherein the next incoming data 
packet is classified according to the already existing class and the new classes that has 
been created). 
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As to claim 37, Riddle, Tang and Del Monte do not teach the limitation "base 
memory, next state memory and base memory configured to contain address locations 
of said next state memory". However Boucher teaches method of protocol processing 
including a base memory, next state memory and base memory configured to contain 
address locations of said next state memory (see fig. 15A-C). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify the combined teachings of Riddle in view of using a base 
memory, next state memory and base memory configured to contain address locations 
of said next state memory as in Boucher. One would be motivated to include a base 
memory in Riddle because doing so would allow DFA to determine the classification of 
the data packet and map an ordered sequence of input events into a corresponding 
sequence according to the control section of the data where the next state is uniquely 
determined by a single input event where the corresponding sequence is determined by 
the next state memory and the single input is determined by the base memory. 

As to claim 38, Boucher teaches memories are random access memories (see 
fig. 15A). 

As to claim 39, Boucher teaches said memories are read-only memories (see fig. 
13 and its corresponding illustration). 

As to claim 40, Riddle teaches a network data configured to provide a data 
packet comprising a stream of data (see claim 1 and fig. 1) and a memory system 
configured with data representing a class index corresponding to each of said 
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terminating states and configured to output a class index in response to production of 
said reached terminating state (see claim 7). 

Riddle doesn't teach the limitation "a first system of memory configured with data 
representing DFA and configured to lexically scan said data stream". 

However Tang Del Monte teaches a system of memory configured with data 
representing a DFA (see col. 14lines 21-31) and Tang teaches a system of logic circuits 
configured to lexically scan a data stream (see abstract, statements in a program are 
lexically scanned). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Riddle in view of decompression logic configured to scan data 
with DFA as in Del Monte and lexically scan data as in Tang. One would be motivated 
modify Riddle by using a memory configured with data representing DFA and lexically 
scan of data because doing so would allow the network to map an ordered sequence of 
input events into a corresponding sequence by scanning the lexical tokens according to 
the control section of the data where the next state is uniquely determined by a single 
input event. 

As to claim 41 , Riddle teaches a third memory configured to contain current state 
information for plural input channels (see claim 1 and fig. 1). 

10. Claims 23-29, 31-36 and 42-54 do not add any new limitations above claims 1-22 
and claims 37-41 and therefore are rejected for similar reasons. 

1 1 . Applicant's arguments filed have been fully considered but they are not 
persuasive. 
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In the remarks, the applicant argues in substance that; A) Riddle does not teach 
the limitation "determining a matching one of said regular expressions that matches said 
data packet"; B) Riddle does not suggest the use of lexical tokens for packet 
classification; C) Tang does not suggest applying lexical scanning to network data; D) 
Riddle does not teach "identifying an arithmetic operation and performing said arithmetic 
operation"; E) Riddle cannot apply skip function in data network packets F) Moreno 
does not suggest modifying Riddle to incorporate a register G) Del Monte teaches the 
use of DFA in parsing documents which makes it improper to combine Del Monte's 
teachings to Riddle. 

In response to A) Riddle classifies data packets according to a set of rules that 
define the grammar for the classification of data (see col. 13 lines 57-col. 14 lines 9) for 
example Riddle checks the protocol type and the port number of the incoming data 
packets and accordingly classifies the data packets (see col. 14 lines 50-col. 15 lines 
20) and therefore the protocol type and the port number are considered to be the 
regular expressions. 

In response to B) Riddle parses the data packets and produces tokens such as 
the protocol type and the port number and classify data packets according to these 
attributes (see col. 14 lines 50-col. 15 lines 20). 

In response to C) In response to applicants argument that there is no suggestion 
to combine the references, the examiner recognizes that obviousness can only be 
established by combining or modifying the teachings of the prior art to produce the 
claimed invention where there is some teaching, suggestion, or motivation to do so 
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found either in the references themselves or in the knowledge generally available to one 
of ordinary skill in the art. See In re Fine, 837 F.2d 1071 , 5 USPQ2d 1596 (Fed. Cir. 
1988)and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). In this case, 
the IP packet is parsed to identify attributes such as protocol type and the port number 
and classify data packets according to these attributes (see col. 14 lines 50-col. 15 lines 
20). 

In response to D) Riddle teaches keeping a record of number of hits and the 
number of times a port has been used in an interval of time (see col. 14 lines 15-30 and 
col. 15 lines 30-45). There is no limit on the kind of arithmetic operation and therefore 
Riddle arithmetic operation meets the scope of the claimed "identifying an arithmetic 
operation and performing said arithmetic operation". 

In response to E) Riddle uses C language to classify data packets (see col. 5 
lines 60-67) where one of the ordinary skill in the art would know how to implement skip 
and branch functions using C language. 

In response to F) In response to applicant's argument that there is no suggestion 
to combine the references, the examiner recognizes that obviousness can only be 
established by combining or modifying the teachings of the prior art to produce the 
claimed invention where there is some teaching, suggestion, or motivation to do so 
found either in the references themselves or in the knowledge generally available to one 
of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 
1988)and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). 
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In response to G) Riddle uses the parsed data such as port number and protocol 
type to classify but does not uses DFA to organize the parsed data. However Del Monte 
teaches the use of DFA to organize parsed data (see col. 14 lines 21-31) and therefore 
it would have been proper to use incorporate DFA in Riddle. 

12. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Hussein A El-chanti whose telephone number is 
(703)305-4652. The examiner can normally be reached on Mon-Fri 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Alio Etienne can be reached on (703)308-7562. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Hussein Elchanti 
March 19, 2004 
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